Search
Find a vulnerability
Search criteria
Related vulnerabilities
ALSA-2026:48170
Vulnerability from osv_almalinux – Published: 2026-07-29 00:00 – Updated: 2026-08-18 08:59 – Source website
VLAI
Summary
Low: php security, bug fix, and enhancement update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)
Bug Fix(es) and Enhancement(s):
- Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)\n\n\nBug Fix(es) and Enhancement(s): \n\n * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:48170",
"modified": "2026-08-18T08:59:59Z",
"published": "2026-07-29T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:48170"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-14355"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/10/ALSA-2026-48170.html"
}
],
"related": [
"CVE-2026-14355",
"CVE-2026-14355",
"CVE-2026-12184"
],
"summary": "Low: php security, bug fix, and enhancement update"
}
ALSA-2026:48197
Vulnerability from osv_almalinux – Published: 2026-07-29 00:00 – Updated: 2026-08-19 12:30 – Source website
VLAI
Summary
Low: php:8.3 security, bug fix, and enhancement update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)
Bug Fix(es) and Enhancement(s):
- Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 9.8.z (JIRA:AlmaLinux-192620)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "apcu-panel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-redis6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.0-3.module_el9.8.0+257+89d727f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-4.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-4.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-xdebug3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-xdebug3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.3-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.3-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.module_el9.8.0+287+a9a5bb73"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)\n\n\nBug Fix(es) and Enhancement(s): \n\n * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 9.8.z (JIRA:AlmaLinux-192620)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:48197",
"modified": "2026-08-19T12:30:41Z",
"published": "2026-07-29T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:48197"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-14355"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-48197.html"
}
],
"related": [
"CVE-2026-14355",
"CVE-2026-14355",
"CVE-2026-12184"
],
"summary": "Low: php:8.3 security, bug fix, and enhancement update"
}
BELL-CVE-2026-12184 (CVE-2026-12184)
Vulnerability from osv_bellsoft – Published: 2026-07-02 09:57 – Updated: 2026-07-08 13:56 – Source website
VLAI
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpaquita:23",
"name": "php81",
"purl": "pkg:apk/alpaquita/php81?arch=source\u0026distro=23"
},
"ranges": [
{
"events": [
{
"introduced": "8.1.19-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Alpaquita:25",
"name": "php83",
"purl": "pkg:apk/alpaquita/php83?arch=source\u0026distro=25"
},
"ranges": [
{
"events": [
{
"introduced": "8.3.21-r0"
},
{
"fixed": "8.3.32-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Alpaquita:stream",
"name": "php83",
"purl": "pkg:apk/alpaquita/php83?arch=source\u0026distro=stream"
},
"ranges": [
{
"events": [
{
"introduced": "8.3.4-r2"
},
{
"fixed": "8.3.32-r0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"id": "BELL-CVE-2026-12184",
"modified": "2026-07-08T13:56:11.115195Z",
"published": "2026-07-02T09:57:20.354061Z",
"references": [
{
"type": "ADVISORY",
"url": "https://docs.bell-sw.com/security/cves/CVE-2026-12184"
}
],
"schema_version": "1.7.4",
"upstream": [
"CVE-2026-12184"
]
}
CERTFR-2026-AVI-0843
Vulnerability from certfr_avis - Published: 2026-07-07 - Updated: 2026-07-07
De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PHP versions 8.5.x ant\u00e9rieures \u00e0 8.5.8",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.32",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.32",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.4.x ant\u00e9rieures \u00e0 8.4.23",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-14355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14355"
},
{
"name": "CVE-2026-12184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12184"
}
],
"initial_release_date": "2026-07-07T00:00:00",
"last_revision_date": "2026-07-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0843",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PHP. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans PHP",
"vendor_advisories": [
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.4.23",
"url": "https://www.php.net/ChangeLog-8.php#8.4.23"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.5.8",
"url": "https://www.php.net/ChangeLog-8.php#8.5.8"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.3.32",
"url": "https://www.php.net/ChangeLog-8.php#8.3.32"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.2.32",
"url": "https://www.php.net/ChangeLog-8.php#8.2.32"
}
]
}
OESA-2026-3049 (CVE-2026-12184)
Vulnerability from osv_openeuler – Published: 2026-07-19 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
php security update
Details
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.
Security Fix(es):
(CVE-2026-12184)
In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)
Severity
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"php-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-bcmath-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-cli-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-common-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-dba-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-dbg-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-debuginfo-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-debugsource-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-devel-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-embedded-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-enchant-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-ffi-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-fpm-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-gd-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-gmp-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-intl-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-ldap-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-mbstring-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-mysqlnd-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-odbc-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-opcache-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-pdo-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-pgsql-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-process-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-snmp-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-soap-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-sodium-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-tidy-8.3.32-1.oe2403sp1.aarch64.rpm",
"php-xml-8.3.32-1.oe2403sp1.aarch64.rpm"
],
"noarch": [
"php-help-8.3.32-1.oe2403sp1.noarch.rpm"
],
"src": [
"php-8.3.32-1.oe2403sp1.src.rpm"
],
"x86_64": [
"php-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-bcmath-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-cli-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-common-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-dba-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-dbg-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-debuginfo-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-debugsource-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-devel-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-embedded-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-enchant-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-ffi-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-fpm-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-gd-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-gmp-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-intl-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-ldap-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-mbstring-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-mysqlnd-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-odbc-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-opcache-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-pdo-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-pgsql-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-process-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-snmp-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-soap-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-sodium-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-tidy-8.3.32-1.oe2403sp1.x86_64.rpm",
"php-xml-8.3.32-1.oe2403sp1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP1",
"name": "php",
"purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-24.03-LTS-SP1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.oe2403sp1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-12184)\n\nIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)",
"id": "OESA-2026-3049",
"modified": "2026-08-06T11:11:56Z",
"published": "2026-07-19T11:11:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3049"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12184"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14355"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "php security update",
"upstream": [
"CVE-2026-12184",
"CVE-2026-14355"
]
}
OESA-2026-3050 (CVE-2026-12184)
Vulnerability from osv_openeuler – Published: 2026-07-19 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
php security update
Details
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.
Security Fix(es):
(CVE-2026-12184)
In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)
Severity
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"php-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-bcmath-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-cli-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-common-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-dba-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-dbg-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-debuginfo-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-debugsource-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-devel-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-embedded-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-enchant-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-ffi-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-fpm-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-gd-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-gmp-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-intl-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-ldap-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-mbstring-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-mysqlnd-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-odbc-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-opcache-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-pdo-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-pgsql-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-process-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-snmp-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-soap-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-sodium-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-tidy-8.3.32-1.oe2403sp3.aarch64.rpm",
"php-xml-8.3.32-1.oe2403sp3.aarch64.rpm"
],
"noarch": [
"php-help-8.3.32-1.oe2403sp3.noarch.rpm"
],
"src": [
"php-8.3.32-1.oe2403sp3.src.rpm"
],
"x86_64": [
"php-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-bcmath-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-cli-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-common-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-dba-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-dbg-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-debuginfo-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-debugsource-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-devel-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-embedded-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-enchant-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-ffi-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-fpm-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-gd-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-gmp-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-intl-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-ldap-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-mbstring-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-mysqlnd-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-odbc-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-opcache-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-pdo-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-pgsql-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-process-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-snmp-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-soap-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-sodium-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-tidy-8.3.32-1.oe2403sp3.x86_64.rpm",
"php-xml-8.3.32-1.oe2403sp3.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP3",
"name": "php",
"purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-24.03-LTS-SP3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.oe2403sp3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-12184)\n\nIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)",
"id": "OESA-2026-3050",
"modified": "2026-08-06T11:11:56Z",
"published": "2026-07-19T11:11:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3050"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12184"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14355"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "php security update",
"upstream": [
"CVE-2026-12184",
"CVE-2026-14355"
]
}
OESA-2026-3051 (CVE-2026-12184)
Vulnerability from osv_openeuler – Published: 2026-07-19 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
php security update
Details
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.
Security Fix(es):
(CVE-2026-12184)
In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)
Severity
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"php-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-bcmath-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-cli-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-common-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-dba-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-dbg-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-debuginfo-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-debugsource-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-devel-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-embedded-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-enchant-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-ffi-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-fpm-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-gd-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-gmp-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-intl-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-ldap-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-mbstring-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-mysqlnd-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-odbc-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-opcache-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-pdo-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-pdo-dblib-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-pdo-firebird-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-pgsql-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-process-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-snmp-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-soap-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-sodium-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-tidy-8.3.32-1.oe2403sp4.aarch64.rpm",
"php-xml-8.3.32-1.oe2403sp4.aarch64.rpm"
],
"noarch": [
"composer-generators-8.3.32-1.oe2403sp4.noarch.rpm",
"php-help-8.3.32-1.oe2403sp4.noarch.rpm"
],
"src": [
"php-8.3.32-1.oe2403sp4.src.rpm"
],
"x86_64": [
"php-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-bcmath-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-cli-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-common-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-dba-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-dbg-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-debuginfo-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-debugsource-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-devel-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-embedded-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-enchant-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-ffi-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-fpm-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-gd-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-gmp-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-intl-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-ldap-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-mbstring-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-mysqlnd-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-odbc-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-opcache-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-pdo-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-pdo-dblib-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-pdo-firebird-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-pgsql-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-process-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-snmp-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-soap-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-sodium-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-tidy-8.3.32-1.oe2403sp4.x86_64.rpm",
"php-xml-8.3.32-1.oe2403sp4.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP4",
"name": "php",
"purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-24.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.32-1.oe2403sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-12184)\n\nIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)",
"id": "OESA-2026-3051",
"modified": "2026-08-06T11:11:56Z",
"published": "2026-07-19T11:11:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3051"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12184"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14355"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "php security update",
"upstream": [
"CVE-2026-12184",
"CVE-2026-14355"
]
}
OPENSUSE-SU-2026:11269-1
Vulnerability from csaf_opensuse - Published: 2026-07-14 00:00 - Updated: 2026-09-17 17:14Summary
php8-8.5.8-1.1 on GA media
Severity
Moderate
Scope
2 vulnerabilities in this advisory, including CVE-2026-12184.
CVE-2026-12184
5.9 (Medium)
Recommended: 188 products
OPENSUSE-SU-2026:21308-1
Vulnerability from csaf_opensuse - Published: 2026-07-12 13:02 - Updated: 2026-09-17 17:38Summary
Security update for php8
Severity
Moderate
Scope
2 vulnerabilities in this advisory, including CVE-2026-12184.
CVE-2026-12184
5.9 (Medium)
Recommended: 213 products
SUSE-SU-2026:22635-1
Vulnerability from csaf_suse - Published: 2026-07-12 13:02 - Updated: 2026-09-17 16:01Summary
Security update for php8
Severity
Moderate
Scope
2 vulnerabilities in this advisory, including CVE-2026-12184.
CVE-2026-12184
5.9 (Medium)
Recommended: 418 products
UBUNTU-CVE-2026-12184 (CVE-2026-12184)
Vulnerability from osv_ubuntu – Published: 2026-07-03 00:00 – Updated: 2026-07-21 10:36 – Source website
VLAI
Details
PHP: Failure to setup TLS with a remote server can result in a remote DoS
Severity
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libapache2-mod-php8.4",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "libphp8.4-embed",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-bcmath",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-bz2",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-cgi",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-cli",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-common",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-curl",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-dba",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-enchant",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-fpm",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-gd",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-gmp",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-interbase",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-intl",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-ldap",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-mbstring",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-mysql",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-odbc",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-opcache",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-pgsql",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-phpdbg",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-readline",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-snmp",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-soap",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-sqlite3",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-sybase",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-tidy",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-xml",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-xsl",
"binary_version": "8.4.11-1ubuntu1.2"
},
{
"binary_name": "php8.4-zip",
"binary_version": "8.4.11-1ubuntu1.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "php8.4",
"purl": "pkg:deb/ubuntu/php8.4@8.4.11-1ubuntu1.2?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.4.5-1ubuntu1",
"8.4.8-1ubuntu1",
"8.4.11-1ubuntu1",
"8.4.11-1ubuntu1.1",
"8.4.11-1ubuntu1.2"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libapache2-mod-php8.5",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "libphp8.5-embed",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-bcmath",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-bz2",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-cgi",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-cli",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-common",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-curl",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-dba",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-enchant",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-fpm",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-gd",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-gmp",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-interbase",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-intl",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-ldap",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-litespeed",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-mbstring",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-mysql",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-odbc",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-pgsql",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-phpdbg",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-readline",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-snmp",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-soap",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-sqlite3",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-sybase",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-tidy",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-xml",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-xsl",
"binary_version": "8.5.4-0ubuntu1.2"
},
{
"binary_name": "php8.5-zip",
"binary_version": "8.5.4-0ubuntu1.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "php8.5",
"purl": "pkg:deb/ubuntu/php8.5@8.5.4-0ubuntu1.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.4-0ubuntu1.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.2-0ubuntu1",
"8.5.4-0ubuntu1",
"8.5.4-0ubuntu1.1"
]
}
],
"aliases": [],
"details": "PHP: Failure to setup TLS with a remote server can result in a remote DoS",
"id": "UBUNTU-CVE-2026-12184",
"modified": "2026-07-21T10:36:37Z",
"published": "2026-07-03T00:00:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-12184"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12184"
},
{
"type": "REPORT",
"url": "https://github.com/php/php-src/security/advisories/GHSA-mhmq-mmqj-2v39"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8564-1"
}
],
"related": [
"USN-8564-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-12184"
]
}
WID-SEC-W-2026-2186
Vulnerability from csaf_certbund - Published: 2026-07-02 22:00 - Updated: 2026-09-06 22:00Summary
PHP: Mehrere Schwachstellen ermöglichen Denial of Service
Severity
Mittel
Scope
2 vulnerabilities in this advisory, including CVE-2026-12184.
CVE-2026-12184
Known affected: 12 products